apm-audit-security
Audits dependencies to ensure integrity, detect drift, and block compromised primitives from reaching production.
Install
mkdir -p .claude/skills/apm-audit-security && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/16718" && unzip -o skill.zip -d .claude/skills/apm-audit-security && rm skill.zipInstalls to .claude/skills/apm-audit-security
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Audits APM dependencies for supply-chain safety — apm audit flags, the content-hash / cache-integrity / unicode-scan / drift-detection model, and audit as a CI gate. Use when verifying installed primitives are untampered, wiring audit into CI, stripping hidden characters, or checking for drift before committing.Key capabilities
- →Verify installed primitives are untampered
- →Wire audit into CI as a merge gate
- →Strip hidden Unicode from files
- →Check for drift before committing generated output
- →Scan an arbitrary file for security issues
How it works
The skill uses `apm audit` to perform content-hash verification, cache-hit integrity checks, Unicode scanning, and drift detection to ensure deployed primitives match the lockfile and are free from malicious content.
Inputs & outputs
When to use apm-audit-security
- →Auditing dependency integrity
- →Setting up ci security gates
- →Checking for code drift
About apm-audit-security
Provides command-line tools to audit deployed dependencies. It performs content hashing, cache-integrity scans, and strips hidden Unicode characters to maintain supply-chain security.
Audits APM dependencies for supply-chain safety — apm audit flags, the content-hash / cache-integrity / unicode-scan / drift-detection model, and audit as a CI gate. Use when verifying installed primitives are untampered, wiring audit into CI, stripping hidden characters, or checking for drift befor
When not to use it
- →When installing or updating dependencies
- →When authoring primitives
- →When not needing supply-chain safety checks
Limitations
- →apm audit only sees the directory it runs from
- →Does not cover policy authoring
- →Does not cover org-level allow/deny enforcement
How it compares
This workflow provides a complete, automated security audit for APM dependencies, integrating checks like Unicode scanning and drift detection that go beyond basic dependency vulnerability scanning.
Compared to similar skills
apm-audit-security side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| apm-audit-security (this skill) | 0 | 1mo | Review | Intermediate |
| secrets-management | 5 | 4mo | Review | Advanced |
| security-scanning-security-hardening | 3 | 4mo | No flags | Advanced |
| github-actions-hardening | 0 | 1mo | No flags | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
secrets-management
wshobson
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
security-scanning-security-hardening
sickn33
Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
github-actions-hardening
locus313
Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped to
repo-security-posture
superagent-ai
Audit a GitHub repository's security posture and hardening gaps across branch protection, CODEOWNERS, GitHub Actions, publish/release integrity, collaborator access, security features, and dependency review. Use when reviewing or hardening a repo, assessing GitHub configuration, checking CI/CD or Ac
supply_chain_security
zerAda
Docker image signing (Cosign), SBOM generation, SLSA provenance attestation, GHCR registry management.
odoo-image-supply-chain
Insightpulseai
Close container image supply-chain gap with automated ACR builds, vulnerability scanning, and image signing